Vulnerability Details CVE-2021-24606
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.4%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2021-24606
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.0
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.1
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.2
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.3
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.4
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.5
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.6
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.7
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.8
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.1.9
-
cpe:2.3:a:offshorewebmaster:availability_calendar:1.2